https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:55:40.512113+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-02891 bdu:2024-02891 2026-10-02T14:55:40.517516+00:00 bdu:2024-02891 https://cve.radiocsirt.org/vuln/euvd-2026-245416 EUVD-2026-245416 2026-10-02T14:55:40.517548+00:00 EUVD-2026-245416 https://cve.radiocsirt.org/vuln/fkie_cve-2024-23905 fkie_cve-2024-23905 2026-10-02T14:55:40.517563+00:00

Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.

 https://cve.radiocsirt.org/vuln/ghsa-x22x-5pp9-8v7f GHSA-x22x-5pp9-8v7f — Content-Security-Policy disabled by Red Hat Dependency Analytics Jenkins Plugin 2026-10-02T14:55:40.517591+00:00

Affected: Maven: io.jenkins.plugins:redhat-dependency-analytics

Jenkins sets the Content-Security-Policy header to static files served by Jenkins (specifically DirectoryBrowserSupport), such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified.

Red Hat Dependency Analytics Plugin 0.7.1 and earlier globally disables the Content-Security-Policy header for static files served by Jenkins whenever the 'Invoke Red Hat Dependency Analytics (RHDA)' build step is executed. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.

 https://cve.radiocsirt.org/vuln/gsd-2024-23905 gsd-2024-23905 2026-10-02T14:55:40.517620+00:00 gsd-2024-23905 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0199 WID-SEC-W-2024-0199 — Jenkins: Mehrere Schwachstellen 2026-10-02T14:55:40.517633+00:00

Ein entfernter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Cross-Site Scripting (XSS)-Angriffe durchzuführen.